Flawfinder – Source Code Auditing Tool

Darknet spilled these bits on September 16th 2009 @ 9:46 am
Flawfinder is a program that examines source code and reports possible security weaknesses (flaws) sorted by risk level. It’s very useful for quickly finding and removing at least some potential security problems before a program is widely released to the public. It’s a static analysis source code auditing tool.

Flawfinder is specifically designed to be easy to install and use. After installing it, at a command line just type:

flawfinder directory_with_source_code

Flawfinder works on Unix-like systems today (it’s been tested on GNU/Linux), and it should be easy to port to Windows systems. It requires Python 1.5 or greater to run (Python 1.3 or earlier won’t work).

Speed

Flawfinder is written in Python, to simplify the task of writing and extending it. Python code is not as fast as C code, but for the task I believe it’s just fine. Flawfinder version 0.12 on a 400Mhz Pentium II system analyzed 51055 lines in 39.7 seconds, resulting in an average of 1285 analyzed lines/second. Flawfinder 1.20 and later will report their speed (in analyzed lines/second) if you’re curious.

How it works

Flawfinder works by using a built-in database of C/C++ functions with well-known problems, such as buffer overflow risks (e.g., strcpy(), strcat(), gets(), sprintf(), and the scanf() family), format string problems ([v][f]printf(), [v]snprintf(), and syslog()), race conditions (such as access(), chown(), chgrp(), chmod(), tmpfile(), tmpnam(), tempnam(), and mktemp()), potential shell metacharacter dangers (most of the exec() family, system(), popen()), and poor random number acquisition (such as random()). The good thing is that you don’t have to create this database – it comes with the tool.

Flawfinder then takes the source code text, and matches the source code text against those names, while ignoring text inside comments and strings (except for flawfinder directives). Flawfinder also knows about gettext (a common library for internationalized programs), and will treat constant strings passed through gettext as though they were constant strings; this reduces the number of false hits in internationalized programs.

You can download Flawfinder here:

flawfinder-1.27.tar.gz

Or read more here.

Test Computer for Installed KeyLoggers

Apart from Phishing, Keyloggers are one of the key factors contributing to the rise of cases of Identity theft in recent times. Keyloggers are not the old hardware types anymore, which could easily be spotted by a careful visual inspection of your computer wires and cables.

Today’s keyloggers are smart. They have the capabilities to hide themselves deep into your software applications and operate from there. And they are easy to install and control for a remote person, thanks to some careless attitude of many of the victims.

How to check, if your computer already has a Keylogging Software installed?

Many of the Security Software suites available today are able to detect most of the common keylogging software. As soon as some keylooger is attempted to be installed on your system, your security suite warns you about that and you can take appropriate action.

But, are you sure that your security software is capable of identifying keylogging activities? There is a simple test software available from Zemana, which lets you simulate a keylogger on your computer. You can download it absolutely free and run it on your computer. If your security software is able to detect it, then you may be confident about the effectiveness of that against keyloggers, otherwise it is time to have a second look at your choice of security software.

My Testing of Zemana

I have been using Norton 360 on my Laptop and it was not able to intercept this keylogging simulator software. But at the same time, I am also using KeyScrambler, which encrypts the data you enter through your keyboard. I was happy to note that all the text, which Zemana Keylogging Simulator could cpature was the encrypted text and not the actual keystrokes.

Thus, KeyScrambler was actually performing its job quite effectively and I was protected against such Keylogging activities.

Nice tool, and I recommend you to give it a try to test, if any keylogger is installed onto your system. You never know, when huge surprise start staring on your face.

Download Zemana Keylogging Simulator Test

Crack, Recover or Remove Lost or Forgotten Password in Excel

Passwords are your key to security. We have often advised against the use of weak passwords and not to repeat them at different websites and applications. But using strong passwords has its own inconveniences and hassles.

There are many instances when you may need to crack or recover a lost or forgotten passwords. For instance, an employee might have just left your company and that important client spreadsheet created by him last Friday had a password only known to him. Or you yourself had a locked an important Excel file with a strong password and you are not remembering it just because it is already six months back. Orone of your family members has put a not-so-easy password on your important file.

Or may be, you just want to break the Excel password of a colleague’s file.

We just found a nice tool to crack or recover passwords from Microsoft Excel Files with ease.Petri IT Knowledgebase Team has come out with an Excel Password recovery, which does the job of cracking Excel Passwords in a few clicks.

They have a useful step-by-step guide to help you out for recovering excel passwords. This guide outlines how to use a simple Excel password recovery application to crack lost or forgotten passwords, allowing you to unlock password-encrypted Microsoft Excel documents quickly as possible.

Haraldscan – BlueTooth Discovery Scanner

The scanner will be able to determine Major and Minor device class of device, as well as attempt to resolve the device’s MAC address to the largest known Bluetooth MAC address Vendor list.

The goal of this project is to obtain as many MAC addresses mapped to device vendors as possible.

Requirements

* Python 2.6
* Pybluez
* PySQLite

Installation

1. Unpack to a directory
2. Run python haraldscan -b to build database
3. python haradscan [Options] to run Harald Scan

You can download Haraldscan here:

haraldscan-0.3.tar.gz
haraldscan_osx-0.3.tar.gz – Mac OS X Testing Version

Or read more here.

SWFScan – Free Flash Application Security Scanner

HP SWFScan is a free tool developed by HP Web Security Research Group, which will automatically find security vulnerabilities in applications built on the Flash platform.

HP is offering SWFScan because:

* Their research shows that developers and increasingly implementing applications built on the Adobe Flash platform without the required security expertise.
* As a result, they are seeing a proliferation of insecure applications being deployed on the web.
* A vulnerable application built on the Flash platform widens your website’s attack surface creating more opportunity for malicious hackers.


How SWFScan works and what vulnerabilities it finds:

* Decompiles applications built on the Adobe Flash platform to extract the ActionScript code and statically analyzes it to identify security issues such as information disclosure.
* Identifies and reports insecure programming and deployment practices and suggests solutions.
* Enables you to audit third party applications without requiring access to the source code.

You can download SWFScan here:

SwfScan.msi

Or read more here.

IKECrack – IKE/IPSec Authentication Cracking Tool

IKECrack is an open source IKE/IPSec authentication crack tool. This tool is designed to bruteforce or dictionary attack the key/password used with Pre-Shared-Key [PSK] IKE authentication. The open source version of this tool is to demonstrate proof-of-concept, and will work with RFC 2409 based aggressive mode PSK authentication.

IKE Agressive Mode BruteForce Summary

Aggressive Mode IKE authentication is composed of the following steps:

1.Initiating client sends encryption options proposal, DH public key, random number [nonce_i], and an ID in an un-encrypted packet to the gateway/responder.
2.Responder creates a DH public value, another random number [nonce_r], and calculates a HASH that is sent back to the initiator in an un-encrypted packet. This hash is used to authenticate the parties to each other, and is based on the exchange nonces, DH public values, the initiator ID, other values from the initiator packet, and the Pre-Shared-Key [PSK].
3.The Initiating client sends a reply packet also containing a HASH, but this response is normally sent in an encrypted packet.
IKECrack utilizies the HASH sent in step 2, and attempts a realtime bruteforce of the PSK. This involves a HMAC-MD5 of the PSK with nonce values to determine the SKEYID, and a HMAC-MD5 of the SKEYID with DH pubkeys, cookies, ID, and SA proposal. In practice, SKEYID and HASH_R are calculated with the Hash cipher proposed by the initiator, so could actually be either SHA1 or MD5 in HMAC mode.

Project Details

IKECrack utilizes components from the following OpenSource/PublicDomain programs:

•MDCrack
•Ron Rivest’s MD5
•Simeon Pilgrim’s Reverse MD5
•MD5 and HMAC-MD5 PerlMods
•libpcap

Performance

Initial testing with Perl based IKECrack shows numbers of 18,000 tests per second with a PIII 700, and can bruteforce 3 chars of ucase/lcase/0-9 in 13 seconds.

MDCrack [a MD5 bruteforce tool] can achieve 1.5 million keys per second with pure MD5 and a PIII 700. PSK bruteforcing consists of 4 MD5’s, and 4 64 byte XORs….but should still be able to achieve 375,000 IKE keys per second. Preliminary tests in C have shown 26,000 keys per second with un-optimized routines. I’m hoping that Simeon Pilgrim’s MD5 routines will speed this up a bit more.

You can download IKECrack here:
ikecrack-snarf-1.00.pl

Or read more here.

WifiZoo Passive inforamtion gathering tool

WifiZoo is a tool to gather wifi information passively. I wanted to do something wifi-related somewhat helpful in wifi pentesting and I did this just to have fun after I discovered 'Ferret' from Errata Security. I know neither Ferret or WifiZoo do anything spectacular, but I thought that the idea was fun/useful anyways.

I basically wanted something that I could run and tried by itself to get info from open wifi networks (and possibly encrypted also in the future, at least with WEP :)) without joining any network, and covering all wifi channels, and this is what I came up with so far. Its written in python, I can modify it easily, and it fulfills its not-very-ambitious purpose. Kudos to scapy for doing pretty much all the packet parsing for me (scapy is great).

WifiZoo does the following:

-gathers bssid->ssid information from beacons and probe responses *(now the graph contains the ssid of the bssid :), new in v1.1)*
-gathers list of unique SSIDS found on probe requests (you can keep track of all SSIDS machines around you are probing for, and use this information on further attacks)*new in v1.1*
-gathers the list and graphs which SSIDS are being probed from what sources *new in v1.1*
-gathers bssid->clients information and outputs it in a file that you can later use with graphviz and get a graph with "802.11 bssids->clients".
It gathers both src and dst addresses of packets to make the list of clients so sometimes you get weird graphs that are fun to analyze :) (basically, because I still need to omit multicast dst addresses and things like that). Using the dst address means that sometimes you get mac addresses of wifi devices that are not near you, but I think gives you information about the wifi 'infrastructure', again, I think :).
-gathers 'useful' information from unencrypted wifi traffic (ala Ferret,and dsniff, etc); like pop3 credentials, smtp traffic, http cookies/authinfo, msn messages,ftp credentials, telnet network traffic, nbt, etc.-and I think that's it.

Link:- Wifizoo

WiFi Availability Explodes, But Many Networks Remain Insecure

WiFi access is more pervasive than ever -- but secure wireless access can still be hard to find, a new study said today.

According to a report on WiFi access trends published today by RSA, WiFi access continues to grow at a breakneck pace. The number of wireless access points has increased by 543 percent over the past year in Paris alone, the study says. London has more than 12,275 WiFi hotspots.

However, the security of these access points continues to be an issue. More than half of the hotspots in New York and London were found to be protected only by the now-discredited Wired Equivalant Privacy (WEP) standard, or by no encryption at all, RSA reported.

"Such is the speed at which WEP can be routinely cracked that it barely constitutes paper-thin protection in the face of today's sophisticated hackers," says Sam Curry, vice president of identity and access assurance at RSA. "We would strongly urge wireless administrators to discount WEP as a viable security mechanism and upgrade to WPA [WiFi Protected Access] -- or stronger -- without delay."

Many of the wireless access points found in the study were in-home networks, RSA reported. In London, there are more personal wireless access points than corporate WAPs, the study says
Ref: - Tim Wilson, Site Editor, Dark Reading

Hack Simplifies Attacks On Cisco Routers

A security researcher has discovered a method of hacking Cisco routers with only basic knowledge about the targeted device.

Although researchers have found various vulnerabilities in Cisco routers, exploits mostly have been focused on hacks of specific IOS router configurations, which require targeted and skilled attacks. But Felix "FX" Lindner, a researcher with Recurity Labs, demonstrated last week at the 25th Chaos Communication Congress in Berlin a technique that lets an attacker execute code remotely on Cisco routers, regardless of their configuration.

"The bottom line is that before, all IOS exploits had to know the exact IOS image running on the target to get code execution. This is approximately a 1 to 100,000 chance, [and] a professional attacker doesn't risk his 0-day exploit when the odds are stacked against him like that," Linder says. "I [demonstrated] that at least on one group of Cisco routers, there is a way to execute code without knowing the IOS image version [they are] running."

Lindner says his exploit method is independent of a router vulnerability, and applies only to stack-buffer overflow bugs. He was able to execute memory writes and to disable CPU caches on Cisco routers running on the PowerPC CPU. Lindner hasn't yet tested his technique on larger, more expensive Cisco routers, but plans to do so eventually.

Security researcher Dan Kaminsky says FX's hack disproves conventional wisdom in enterprises that routers are at low risk of attack, and that patching them is riskier than an attack due to the potential network outages that patching can incur.

The research also broke the barrier of one exploit, one router: "Three-and-a-half years ago it was international news that one guy got one exploit working on one Cisco router," he says. "Today, it's now clear that it's possible, given a flaw in IOS, to reliably exploit many versions of many routers.

"Something we thought was difficult, for no good reason, is now shown to be so very simple after all," Kaminsky says.
Lindner says his research shows that detection of Cisco IOS attacks should be focused on the payload of an exploit, such as a backdoor program, rather than on the exploit itself.
To protect against a widespread router attack, Cisco should encourage users to run more standard versions of IOS, as well as make IOS more modular to simplify patching for its customers with customized versions, Kaminsky says.

The bottom line is that enterprises need to change their tune when it comes to their IOS patching policy. When a remote-code execution bug is discovered in one of their routers, they should treat it like any other system vulnerability, Kaminsky says. "They should treat it as equivalent to a vulnerability against sensitive servers or domain controllers, and act accordingly," he says. And that may require working closely with Cisco on just how to do that, he adds.

Ref:- Presentation

WarVOX suite for advanced War Dialer

WarVOX is a suite of tools for exploring, classifying, and auditing telephone systems. Unlike normal wardialing tools, WarVOX works with the actual audio from each call and does not use a modem directly. This model allows WarVOX to find and classify a wide range of interesting lines, including modems, faxes, voice mail boxes, PBXs, loops, dial tones, IVRs, and forwarders.

WarVOX provides the unique ability to classify all telephone lines in a given range, not just those connected to modems, allowing for a comprehensive audit of a telephone system.

WarVOX requires no telephony hardware and is massively scalable by leveraging Internet-based VoIP providers. A single instance of WarVOX on a residential broadband connection, with a typical VoIP account, can scan over 1,000 numbers per hour. The speed of WarVOX is limited only by downstream bandwidth and the limitations of the VoIP service. Using two providers with over 40 concurrent lines we have been able to scan entire 10,000 number prefixes within 3 hours.

The resulting call audio can be used to extract a list of modems that can be fed into a standard modem-based wardialing application for fingerprinting and banner collection. One of the great things about the WarVOX model is that once the data has been gathered, it is archived and available for re-analysis as new signatures, plugins, and tools are developed. The current release of WarVOX (1.0.0) is able to automatically detect modems, faxes, silence, voice mail boxes, dial tones, and voices.

For More inforamtion:
WarVOX 1.0.0

LetDown TCP Flooder, ReverseRaider Subdomain Scanner & Httsquash HTTP Server Scanner Tool

An interesting collection of tools for pen-testing including a DoS tool (something you don’t often see publicly released).

Complemento is a collection of tools that the author originally created for his own personal toolchain for solving some problems or just for fun. Now he has decided to release it to the public.

LetDown is a TCP flooder written after the author read the article by fyodor entitled article “TCP Resource Exhaustion and Botched Disclosure“.

ReverseRaider is a domain scanner that uses brute force wordlist scanning for finding a target sub-domains or reverse resolution for a range of ip addresses. This is similar to some of the functionality in DNSenum.

Httsquash is an HTTP server scanner, banner grabber and data retriever. It can be used for scanning large ranges of IP addresses and finding devices or HTTP servers (there is an alpha version of a GUI for this).

You can download Complemento v0.4b here:
complemento-0.4b
Or read more here.

Web Mail Auth Tool For Testing Web Mail Logins

WMAT is Web Mail Auth Tool that provide some essential functions for testing web mail logins, written in python with support of pyCurl.

How it works?
It is very simple, You give WMAT file with usernames, file with passwords, URL of web mail app and chose pattern for attack. Patterns are XML files that define post/get fields, http method, referer, success tag, etc … for each web mail applications.

There are currently patterns for horde, squirrelmail, kerio and mdaemon web mail.
The XML pattern files look like this:

--- horde.wmat.xml ---


horde_user
horde_pass
login.php
sidebar.php
post



ivan.markovic@netsec.rs

-----------------------


The author of WMAT requests for help from the community with the patterns, the author of the pattern will be credited in the author field of the XML file.

There are some more options like setting timeout (time between each request), bell on success and option for writing output in file. More can be seen in the Readme file here.
For future versions the following additions are planned:
using a proxy
special addon for generation of usernames/passwords
automatic recognizer of web app
You can download WMAT here:
wmat.zipPython source.
Or read more here.

SSLstrip - HTTPS Stripping Attack Tool

This tool provides a demonstration of the HTTPS stripping attacks that was presented at Black Hat DC 2009. It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links. It also supports modes for supplying a favicon which looks like a lock icon, selective logging, and session denial. For more information on the attack, see the video from the presentation on the homepage.

To get this running:

• Flip your machine into forwarding mode.
• Setup iptables to redirect HTTP traffic to sslstrip.
• Run sslstrip.
• Run arpspoof to convince a network they should send their traffic to you.
• That should do it.
  

How does this work?

First, arpspoof convinces a host that our MAC address is the router’s MAC address, and the target begins to send us all its network traffic. The kernel forwards everything along except for traffic destined to port 80, which it redirects to $listenPort (10000, for example).

At this point, sslstrip receives the traffic and does its magic.
You can download sslstrip 0.2 here:
sslstrip-0.2.tar.gz
Or read more here.

Free fuzzing utility for Oracle database applications

Sentrigo announced FuzzOr, an open source fuzzing tool for Oracle databases designed to identify vulnerabilities found in software applications written in PL/SQL code. The new utility allows PL/SQL programmers, database administrators (DBAs) and security professionals to
identify and repair vulnerabilities that may be exploited via SQL injection and buffer overflow attacks—the most common techniques used by malicious hackers to launch attacks on databases.

FuzzOr runs on Oracle database versions 8i and above to identify coding errors. A dynamic
scanning tool, FuzzOr enables DBAs and security pros to test PL/SQL code inside Oracle-stored
program units. Once vulnerabilities are detected by FuzzOr, a programmer can then repair the
PL/SQL code.

Download : https://www.sentrigo.com/register_for_fuzzor.htm

Ip Anonymous Web Surfing Tools 16in1

The following program will help you in anonymous web surfing. The program is a combination of all anonymous surfing softwares and thus are available at one place. So friends, maintain your online privacy and security by anonymous web surfing...without leaving any trace. No need to search internet for fast proxy. Just download the file from rapidshare.

Ip Anonymous Surfing Tools 16in1-------------------------------------------
01 #1 Anonymous Proxy List Verifier 1.1
02 Anonimity 4 Proxy2.8
03 Charon 0.6
04 Get Anonymous 2.1
05 GhostSurf Platinum 2007
06 Hide ip Platinum 3.42
07 Hide The Ip 2.1.1
08 Invisible Browsing 5
09 IP Switcher Professional 1.01.12.0
10 MultiProxy v1.2
11 NetConceal Anonymity Shield 5.2.059.02
12 Proxy Switcher Standard 3.7.2.3913
13 Proxygrab 0.6
14 proxyway extra v3.2
15 SmartProxyHelper 1.5
16 Steganos Internet Anonym 2006 v8.0.1

All keys, cracks, patchs are included. NO PASS.Size: 61 MBDownload Ip Anonymous Surfing Tools 16in1 here:http://rapidshare.com/files/106569928/IP_Anonymous_Surfing_Tool_16in1_.rar

Anonymous web surfing with Ultrasurf

If any of you are banned from forums or any other internet group, or wanted to bypass Rapidshare unlimited download,or bypass school firewall to access sites like Myspace.com, orkut.com or any other sites or the basic thing...want to surf web anonymously without leaving any trace, then this post is for you. In this post, i have mentioned a software used to surf anonymously. The advantage of this software "Ultrasurf" is that it automatically searches for free public fast proxy servers and you just have to start the program. Once, you have started, your IP address is changed by Ultrasurf automatically...

So, if you are in search of fast proxy servers for assigning proxy to your browser....Stop searching. Just download Ultrasurf and start surfing anonymously.

Ultrasurf is totally free software used to surf anonymously. It is better than any other anonymous browsing software. Infact, it searches for 3 fast proxy servers, assigns percentage(%) indicating speed of proxy servers and we can choose any of three.

Download Ultrasurf from UltraReach site or from here

PuttyHijack V1.0 - Hijack SSH/PuTTY Connections on Windows

PuttyHijack is a POC tool that injects a dll into the PuTTY process to hijack an existing, or soon to be created, connection.



This can be useful during penetration tests when a windows box that has been compromised is used to SSH/Telnet into other servers. The injected DLL installs some hooks and creates a socket for acallback connection that is then used for input/output redirection.


It does not kill the current connection, and will cleanly uninject if the socket or process is stopped.


Details


1) Start a nc listener

2) Run PuttyHijack specify the listener ip and port

3) Watch the echoing of everything including passwords





Some basic commands in this version include;


!disco - disconnect the real putty from the display!reco - reconnect it!exit - just another way to exit the injected shell


You can download PuttyHijack V1.0 here:
PuttyHijackV1.0.rar
Or read more here.

PuttyHijack V1.0 - Hijack SSH/PuTTY Connections on Windows

PuttyHijack is a POC tool that injects a dll into the PuTTY process to hijack an existing, or soon to be created, connection.

This can be useful during penetration tests when a windows box that has been compromised is used to SSH/Telnet into other servers. The injected DLL installs some hooks and creates a socket for acallback connection that is then used for input/output redirection.

It does not kill the current connection, and will cleanly uninject if the socket or process is stopped.

Details

1) Start a nc listener
2) Run PuttyHijack specify the listener ip and port
3) Watch the echoing of everything including passwords


Some basic commands in this version include;

!disco - disconnect the real putty from the display!reco - reconnect it!exit - just another way to exit the injected shell

You can download PuttyHijack V1.0 here:
PuttyHijackV1.0.rar
Or read more here.

TSGrinder - Brute Force Terminal Services Server

This is a tool that has been around quite some time too, it’s still very useful though and it’s a very niche tool specifically for brute forcing Windows Terminal Server.

TSGrinder is the first production Terminal Server brute force tool, and is now in release 2. The main idea here is that the Administrator account, since it cannot be locked out for local logons, can be brute forced. And having an encrypted channel to the TS logon process sure helps to keep IDS from catching the attempts.

TSGringer is a “dictionary” based attack tool, but it does have some interesting features like “l337″ conversion, and supports multiple attack windows from a single dictionary file. It supports multiple password attempts in the same connection, and allows you to specify how many times to try ausername/password combination within a particular connection.

You can download TSGrinder 2.0.3 here:
tsgrinder-2.03.zip

Note that the tool requires the Microsoft Simulated Terminal Server Client tool, “roboclient,” which may be found here:
roboclient.zip
Or read more here.

Vista Security Feature - Teredo Protocol Analysis

Teredo is a platform-independent protocol developed by Microsoft, which is enabled by default in Windows Vista. Teredo provides a way for nodes located behind an IPv4 NAT to connect to IPv6 nodes on the Internet. However, by tunneling IPv6 traffic over IPv4 UDP through the NAT and directly to the end node, Teredo raises some security concerns.

Primary concerns include bypassing security controls, reducing defense in depth, and allowing unsolicited traffic. Additional security concerns associated with the use of Teredo include the capability of remote nodes to open the NAT for themselves, benefits to worms, ways to deny Teredo service, and the difficulty in finding all Teredo traffic to inspect.
You can find the report here:
Teredo Security [PDF]